使用说明
Aurora QA 🤖
AI-powered autonomous quality engineering platform — 13 specialized agents, chaos engineering, self-healing tests, MCP server & real-time dashboard
Aurora QA is an intelligent quality engineering platform that uses Claude to autonomously generate tests, find bugs, analyze code security, measure performance, and ensure accessibility. It features 13 specialized AI agents orchestrated through a pipeline system, backed by a vector-based knowledge memory that learns from every analysis.
The platform integrates with your development workflow via the Model Context Protocol (MCP), CI/CD adapters for GitHub Actions, GitLab CI, and Jenkins, and a real-time Next.js dashboard for monitoring.
✨ Features
- 🧪 AI Test Generation — Generates comprehensive test suites covering edge cases, error paths, and happy paths
- 🐛 Intelligent Bug Detection — Deep static analysis with AI-powered reasoning for complex bugs
- 🔒 OWASP Security Scanning — SQL injection, XSS, secrets detection, auth analysis
- ⚡ Performance Analysis — Big O estimation, N+1 queries, memory leak detection
- ♿ Accessibility Checking — WCAG 2.1 AA compliance analysis for HTML and React
- 🔥 Chaos Engineering — Network latency/failure injection, CPU stress, memory pressure, time skew
- 🧬 Mutation Testing — Measures test quality by generating code mutations
- 📋 Contract Testing — Pact-inspired API contract verification
- 🩹 Self-Healing Tests — Automatically classifies and fixes flaky tests
- 🎭 Browser Automation — AI-powered semantic element targeting with Playwright
- 🧠 Knowledge Memory — TF-IDF vector store learns from every analysis session
- 🛡️ Circuit Breaker — Auto-halts agents after consecutive failures to prevent token waste
- ⏱️ Timeout Control — AbortController-based API timeouts with graceful degradation
- 📊 Real-time Dashboard — Next.js 15 dashboard with SSE live updates
- 🔌 MCP Integration — 12 tools available in Claude Desktop, Cursor, VS Code
- 🧾 Evidence Grading (v1.3) — every finding graded by how it can be proven; severity is capped by evidence, so hallucinated "criticals" are auto-downgraded
- 🚦 Quality Gates (v1.3) — deterministic exit code from explicit budgets; only evidence-backed findings can fail your build
- 📤 SARIF / JUnit / Markdown (v1.3) — inline GitHub PR annotations, CI test tabs, PR summaries
🚦 Quality Gates (v1.3)
The hard problem with AI QA isn't generating findings — it's trusting them.
pnpm --filter @aurora-qa/cli build
node packages/cli/bin/aurora-qa.js gate examples/gate/findings.json \
--sources examples/gate --sarif aurora-qa.sarif --md pr.md
| Sev | Evidence | Conf | Finding |
|--------|------------------|-------|----------------------------------------|
| high | 📐 static-match | 0.782 | SQL injection via string concatenation |
| medium | 🔗 citation | 0.480 | Hardcoded secret detected |
| low | 💭 heuristic | 0.245 | Possible race condition in cache warmup|
| info | 🚫 unverifiable | 0.044 | Unbounded recursion in parseTree() |
The last one claimed critical — but it cited code that doesn't exist in the file,
so it was capped at info and flagged as a hallucination suspect. It can never break your build.
The first one matched a deterministic rule, so it does.
🏗 Architecture
┌──────────────────────────────────────────────────────────────┐
│ Aurora QA Platform │
├──────────────────────────────────────────────────────────────┤
│ │
│ ┌─────────────────── Orchestrator ────────────────────────┐ │
│ │ │ │
│ │ ┌─────────────┐ ┌─────────────┐ ┌──────────────────┐ │ │
│ │ │ TestGen │ │ TestRunner │ │ BugAnalyzer │ │ │
│ │ │ Agent │ │ Agent │ │ Agent │ │ │
│ │ └─────────────┘ └─────────────┘ └──────────────────┘ │ │
│ │ ┌─────────────┐ ┌─────────────┐ ┌──────────────────┐ │ │
│ │ │ Coverage │ │ Review │ │ Healer │ │ │
│ │ │ Agent │ │ Agent │ │ Agent │ │ │
│ │ └─────────────┘ └─────────────┘ └──────────────────┘ │ │
│ │ ┌─────────────┐ ┌─────────────┐ ┌──────────────────┐ │ │
│ │ │ Security │ │ Performance │ │ Accessibility │ │ │
│ │ │ Agent │ │ Agent │ │ Agent │ │ │
│ │ └─────────────┘ └─────────────┘ └──────────────────┘ │ │
│ │ ┌─────────────┐ ┌─────────────┐ ┌──────────────────┐ │ │
│ │ │ Chaos │ │ Mutation │ │ Contract │ │ │
│ │ │ Agent │ │ Agent │ │ Agent │ │ │
│ │ └─────────────┘ └─────────────┘ └──────────────────┘ │ │
│ │ ┌─────────────┐ │ │
│ │ │ Playwright │ Pipeline Runner │ │
│ │ │ Agent │ (topological execution) │ │
│ │ └─────────────┘ │ │
│ └─────────────────────────────────────────────────────────┘ │
│ │
│ ┌─── Memory Layer ───┐ ┌── Intelligence ──┐ ┌── Events ──┐│
│ │ VectorStore (TF-IDF│ │ ReasoningEngine │ │ EventStream││
│ │ KnowledgeBase │ │ TestPrioritizer │ │ (SSE) ││
│ │ EpisodicMemory │ └──────────────────┘ └────────────┘│
│ │ PatternLibrary │ ┌── Metrics ────────┐ │
│ │ WorkingMemory │ │ MetricsCollector │ │
│ └────────────────────┘ │ (Prometheus fmt) │ │
│ └───────────────────┘ │
├──────────────────────────────────────────────────────────────┤
│ MCP Server (12 tools) │ Dashboard (Next.js 15) │ CI/CD │
└──────────────────────────────────────────────────────────────┘
🚀 Quick Start
# 1. Clone the repository
git clone https://github.com/Zijian-Ni/aurora-qa.git && cd aurora-qa
# 2. Install dependencies
pnpm install
# 3. Build all packages
pnpm build
# 4. Set your API key
export ANTHROPIC_API_KEY=sk-ant-...
# 5. Run an example
node_modules/.bin/tsx examples/basic-pipeline/index.ts
📖 API Usage
import { Orchestrator, loadConfig } from '@aurora-qa/core';
// Initialize with config
const config = loadConfig({ anthropicApiKey: process.env.ANTHROPIC_API_KEY! });
const orchestrator = new Orchestrator({ config });
// Generate tests for a source file
const testOutput = await orchestrator.generateTests({
sourceCode: 'export function add(a: number, b: number) { return a + b; }',
filePath: 'src/math.ts',
framework: 'vitest',
});
// Run security scan
const securityReport = await orchestrator.scanSecurity(
'const query = `SELECT * FROM users WHERE id = ${userId}`;',
'src/db.ts',
);
// Analyze performance
const perfAnalysis = await orchestrator.analyzePerformance(
'for (const user of users) { await db.find(user.id); }',
'typescript',
);
// Run a full pipeline
const run = await orchestrator.runPipeline({
id: 'my-pipeline',
name: 'Full QA',
steps: [
{ id: 'gen', type: 'generate-tests', name: 'Generate', config: { sourceCode: '...', filePath: 'app.ts' } },
{ id: 'sec', type: 'scan-security', name: 'Security', config: { code: '...' } },
{ id: 'perf', type: 'analyze-performance', name: 'Performance', config: { code: '...' } },
],
triggers: [{ type: 'manual' }],
environment: {},
createdAt: new Date(),
updatedAt: new Date(),
});
// Health check
console.log(orchestrator.health());
// Shutdown
await orchestrator.shutdown();
🤖 Agents (13 total)
| Agent | Role | Key Capabilities |
|---|---|---|
| TestGenerator | Test creation | Generates comprehensive test suites with edge cases |
| TestRunner | Test execution | Runs tests, parses output with AI |
| BugAnalyzer | Bug detection | Deep static analysis, severity ratings |
| CoverageAgent | Coverage analysis | Gap detection, threshold checking |
| ReviewAgent | Code review | Quality scoring, issue categorization |
| HealerAgent | Self-healing | Classifies failures, suggests automated fixes |
| PlaywrightAgent | Browser automation | AI-powered semantic element targeting |
| SecurityAgent | Security scanning | OWASP-aligned vulnerability detection |
| PerformanceAgent | Performance analysis | Big O, N+1 queries, memory leaks |
| AccessibilityAgent | a11y checking | WCAG 2.1 AA compliance |
| ChaosAgent | Chaos engineering | Resilience testing with fault injection |
| MutationAgent | Mutation testing | Measures test quality via code mutations |
| ContractAgent | Contract testing | API contract verification (Pact-inspired) |
🔌 MCP Tools (12 tools)
| Tool | Description |
|---|---|
generate_tests |
Generate comprehensive test cases for source code |
run_tests |
Execute tests and return structured results |
analyze_bugs |
Deep static analysis for bugs and vulnerabilities |
review_code |
Thorough code review with scoring |
analyze_coverage |
Coverage gap analysis |
query_knowledge |
Search the knowledge base for patterns |
scan_security |
OWASP security scanning |
check_dependencies |
Vulnerable dependency detection |
design_chaos_experiment |
Design chaos engineering scenarios |
check_accessibility |
WCAG compliance checking |
analyze_performance |
Performance issue detection |
run_mutation_testing |
Mutation testing for test quality |
📊 Dashboard
The Next.js 15 dashboard provides real-time monitoring:
┌──────────────────────────────────────────────┐
│ Aurora QA ● Live │
├──────────┬───────────────────────────────────┤
│ │ [Runs: 142] [Pass: 94.2%] │
│ ◈ Dash │ [Bugs: 23] [Avg: 4.2s] │
│ ▶ Runs │ │
│ ⚙ Agent │ Agent Status (13 agents) │
│ 🪲 Bugs │ Recent Pipeline Runs │
│ │ Bug Tracker with Severity │
└──────────┴───────────────────────────────────┘
pnpm dashboard # http://localhost:3001
🔥 Chaos Engineering
Aurora QA includes a full chaos engineering engine:
- Network Latency — Inject artificial delays into fetch calls
- Network Failure — Randomly fail network requests
- CPU Stress — Block the event loop to simulate load
- Memory Pressure — Allocate memory to test GC behavior
- Random Errors — Inject errors at configurable probability
- Time Skew — Offset
Date.now()for temporal testing
import { ChaosEngine } from '@aurora-qa/core';
const engine = new ChaosEngine();
engine.injectNetworkLatency(200, 0.5); // 200ms delay, 50% probability
engine.injectNetworkFailure(0.1); // 10% failure rate
// ... run your tests ...
engine.reset();
🧠 Intelligence Layer
- EpisodicMemory — Stores and recalls past analysis sessions with time-decay scoring
- PatternLibrary — Learns successful test patterns and matches them to new contexts
- WorkingMemory — Short-term context for current pipeline run
- ReasoningEngine — Chain-of-thought reasoning for complex decisions
- TestPrioritizer — Smart test ordering based on change proximity, failure history, and criticality
⚙️ Configuration
# Environment variables
ANTHROPIC_API_KEY=sk-ant-... # Required
AURORA_MODEL=claude-opus-4-6 # AI model (default: claude-opus-4-6)
DASHBOARD_PORT=3001 # Dashboard port
DASHBOARD_HOST=0.0.0.0 # Dashboard host
CORS_ORIGINS=http://localhost:3000
📖 Examples
| Example | Description |
|---|---|
basic-pipeline |
Full QA pipeline on utility functions |
security-scan |
Security scanning on vulnerable code |
chaos-resilience |
Chaos engineering experiments |
🤝 Contributing
See CONTRIBUTING.md for guidelines.
- Fork the repository
- Create your feature branch:
git checkout -b feat/amazing-feature - Commit changes:
git commit -m 'feat: add amazing feature' - Push:
git push origin feat/amazing-feature - Open a Pull Request
📄 License
MIT — Built with ❤️ by Zijian Ni & Aurora Xiaoluo 🎀
